International action against organised investment fraud on the internet

On April 2, 2020, after extensive investigations by a concentrated action of law enforcement agencies from Germany, Austria, Serbia and Bulgaria, numerous measures were carried out. This resulted in a number of arrests and the seizure of funds amounting to over 2 million euro. The background are investigations against two groups of perpetrators who are said to have defrauded thousands of investors from all over Europe of a total of more than 100 million euros in recent years.

1. International Criminal Investigations

As announced by the Bamberg public prosecutor’s office in a press release dated 7 April 2020, despite the restrictions and special challenges associated with the Corona pandemic the “action day” took place. Among other things, five suspects were arrested in Serbia and four in Bulgaria, numerous objects were searched and almost EUR 2.5 million were confiscated. On the German side, the investigations are led by the Central Office for Cybercrime Bavaria set up at the Bamberg Prosecutor General’s Office, which emphatically fights organised fraud in the form of so-called “cyber trading”.

Bamberg/ Belgrade/Sofia. Just only last week a total of 7 men and 2 women aged between 25 and 49 years were arrested simultaneously in Bulgaria (Sofia) and Serbia (Belgrade). On the other hand, the Central Office Cybercrime Bavaria, in close cooperation with the Criminal Investigation Department in Bamberg, had obtained arrest warrants for all persons for commercial and gang fraud. Due to the German search measures, the detention has now taken place. Among those arrested people, is a 36 year old german.

In addition, a number of other operational measures were implemented in Serbia and Bulgaria. During the Investigation of more than 10 objects including 2 call centers, extensive evidence was secured. Apartments and Cars were confiscated in Serbia. In Germany, an amount of almost 2.5 million euros in a central account was seizured. Several recently active platforms on the Internet had been “switched off”.

2. Investment Fraud through Fake Websites

The “action day” was directed against two groups of perpetrators who in recent years, following the same modus operandi, have caused serious financial losses to private investors across Europe on a large scale via so-called cyber trading platforms operated under different domains. The basic structure of the course of action is regularly the same. The perpetrators are pretending to provide potential customers with digital platforms for trading a wide variety of financial instruments (until they were banned, mainly binary options, now especially CFDs, Forex, crypto currencies). The investor opens a trading account on the provider’s website, for which a sum of about 250-300 euros is usually required. Subsequently, specially trained “trading specialists” (so-called brokers or agents) persuade the clients via telephone, messenger services or e-mail to invest larger sums in trading the above-mentioned financial instruments. Payments are usually made by credit card debits or bank transfers. Both domestic and foreign deposit accounts are typically provided by dummy companies or financial agents. The money is distributed via a complex money laundering network installed throughout Europe. The perpetrator groups operate call centers abroad, where dozens of people with the necessary foreign language skills act fraudulently under aliases. The perpetrators use all conceivable concealment techniques at all levels.

3. International organized Cybercrime

An investment or a placement of options as well as the holding of investor funds for repayment or distribution of profits does not actually take place. At no time are the deposited funds allocated to an investment, the trading platform visible to the customer is a pure deception, as is the alleged customer account. Particularly at the beginning of the business relationship, investors are regularly presented with simulated charts that falsely show considerable profits, combined with the demand for further investments. In fact, the presented charts can be manipulated at will by the perpetrators using software specially developed for this purpose. If the investor demands payment of his invested money and the profit made, this will be refused – with the exception of occasional small amounts – using various excuses. In a large number of cases, a total loss of the invested capital occurs after individual failed (alleged) trades.

4. Many fraud victims from Germany

Several thousand investors in Germany are affected by the crime phenomenon attributable to international organised (cyber) crime. In numerous other European countries there are countless other victims. The dark field is considerable, as many investors are aware of the high risk of loss of the chosen investment type and erroneously assume that this very risk has materialised. Accordingly, they refrain from filing a complaint.

5. Internet Platforms switched off

The perpetrators, against whom Action Day on 2 April was directed, have operated the following platforms, among others, in the past three years: XTraderFX, Cryptopoint, SafeMarkets, OptionStarsGlobal and GoldenMarkets as well as Trade Capital, Fibonetix, Nobel Trade and Forbslab. Hundreds of complaints from victims of these platforms are pending at the Central Office Cybercrime Bavaria alone, the (displayed) total damage amounts to approximately 10 million Euros.

6. Arrest Warrants

Those arrested are call centre agents who were particularly “successful” with German-speaking claimants and are partly “top brokers” responsible for losses in the millions.

7. International Cooperation of Prosecutors

The “Action Day” was preceded by intensive cooperation between the German investigating authorities and public prosecutors in Serbia, Bulgaria and Austria. These were supported by Eurojust and Europol.The General Public Prosecutor’s Office in Bamberg and the Central Public Prosecutor’s Office for the Prosecution of Economic Crimes and Corruption in Vienna have formed a “Joint Investigation Team” (JIT) to promote and coordinate international investigations .This form of cooperation also facilitates the exchange of knowledge and evidence. At the judicial level, the Special Prosecution Office for High-Tech Crime Often the Republic of Serbia in Belgrade and the Bulgarian Specialised Prosecutor’s Office in Sofia were particularly responsible for implementing the measures on the ground.

According to the investigators, the fact that it was possible to operate smoothly and effectively across borders despite the corona pandemic is proof of the good relations between the Bamberg Prosecutor General’s Office and the police services involved and their European partners.

8. Central Office Cybercrime Bavaria near the City of Nueremberg

The complex and elaborate investigations of the Central Office Cybercrime Bavaria, the Criminal Police Inspectorate with Central Tasks Lower Franconia, the Bamberg Criminal Police Inspectorate and the Munich Police Headquarters together with their foreign partners continue.

Since January 1, 2015, the Central Office for Cybercrime Bavaria has been located at the Bamberg Prosecutor General’s Office, near the City of Nueremberg. This central office is responsible for the processing of special investigation proceedings in the field of cybercrime throughout Bavaria. They Investigate in Coorporation with appropriate specialists from the Bavarian police or the Federal Criminal Police Office and with international partners for example in the case of attacks on important branches of the economy or in the case of proceedings in the field of organised cybercrime. Since August 2018, a special working group has been pursuing high-profile cases of economic cybercrime and is devoting itself intensively to the “cybertrading” crime phenomenon. At present, 14 public prosecutors work at the Central Office for Cybercrime in Bavaria.